USB Host PTP Property Enumeration Out-of-Bounds Write

STM32Cube USB Host Library 3.5.4 and earlier uses an unbounded NumberOfValues field from a PTP object-property descriptor to populate a fixed 100-entry SupportedValue array. A malicious PTP/MTP device can return an excessive count and trigger out-of-bounds writes, causing memory corruption or a host crash. ST fixed the issue in USB Host Library 3.5.5.